2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
Size 5.4MB
Sample261012-s8lp3sct2z
SHA256 1dbbc80f15e355a7e6ff6e93886cf901a114ce113e041b3a5e65d62dbfc40b1e
MD5 931d4317c00e5975d1cf2d5633627a03
SHA1 ce12f38c78047bdbb8d89fefe956e2b467c89ccc
SHA512 c88dfd8f8f56d78051279cb478f7c46de9adbe627424156a374f7ea8b895438c15159c6fd5b43da15c29622a4b89e7861d817b1efc32bd371a2d3cb807ca2c2b
SSDEEP 49152:aLZMHkswQXhXM3MVYec7Fb3dLDGGCL1gqo4M0fiop+NGMdzw2rCsxQyPsHC6dP4i:ywzc7PULFHq9C2X9FiQkK7bWEdgL0OI8
TLSH
T135468C13F29611D8C019D179879AD232EA62BC554B31A6DF06D07E633F7AEE06B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

.exe 5.4MB

2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

IMPHASH 09fe9283b1710d6133933a430e1b2808
SHA256 1dbbc80f15e355a7e6ff6e93886cf901a114ce113e041b3a5e65d62dbfc40b1e
MD5 931d4317c00e5975d1cf2d5633627a03
SHA1 ce12f38c78047bdbb8d89fefe956e2b467c89ccc
SHA512 c88dfd8f8f56d78051279cb478f7c46de9adbe627424156a374f7ea8b895438c15159c6fd5b43da15c29622a4b89e7861d817b1efc32bd371a2d3cb807ca2c2b
SSDEEP 49152:aLZMHkswQXhXM3MVYec7Fb3dLDGGCL1gqo4M0fiop+NGMdzw2rCsxQyPsHC6dP4i:ywzc7PULFHq9C2X9FiQkK7bWEdgL0OI8
TLSH
T135468C13F29611D8C019D179879AD232EA62BC554B31A6DF06D07E633F7AEE06B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2403296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AvastBrowser.exe.pdb

chrome_elf

GetInstallDetailsPayload IsBrowserProcess IsExtensionPointDisableSet SignalChromeElf SignalInitializeCrashReporting

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapDestroy HeapLock HeapSetInformation HeapUnlock HeapWalk InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus PrefetchVirtualMemory QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadDirectoryChangesW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessMitigationPolicy SetProcessShutdownParameters SetStdHandle SetThreadAffinityMask SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory

ntdll

NtClose NtOpenKeyEx NtQueryInformationProcess NtQueryObject NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlGetLastNtStatus RtlInitUnicodeString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

417KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

242KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

721B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

446KB

Virtual Size

445KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

771KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_931d4317c00e5975d1cf2d5633627a03_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

chrome_elf

kernel32

ntdll

version

generic